hidden file

[Guest]

I've tried searching for this file but nothing comes up. I looked through
just about every place I can think of and still nothing. Every time I boot up
my computer a message comes up and asks me if I want to start this hack. I
click no everytime and thankfully nothing happens. I just want to get rid of
it. Can anyone help me?

 

[Will Denny]

Hi

What is the name of the file and the error message you see?

 

[Guest]

It's not really an error message. I think it's part of the program/file
asking if I want to start it up.

 

[Will Denny]

Hi

Have a look in msconfig>startup to see if the file is referenced there. If
so, uncheck it and reboot your system.

 

[Guest]

Could you tell me where I can find msconfig?

Hi

Have a look in msconfig>startup to see if the file is referenced there. If
so, uncheck it and reboot your system.

--

Will Denny
MS-MVP Windows Shell/User
Please reply to the News Groups

 

[Will Denny]

Hi

From Start>Run type

msconfig

then click on the startup tab. You may have to drag the 'Command' column to
the right to see if the file is referenced.

 

[Guest]

I found the startup menu and took it off, then rebooted my computer. The
screen asking whether I want to start it or not has stopped coming up, but
for some reason it still seems to run. In the startup menu it said that the
file/program was located in 'SOFTWARE/Microsoft/Windows/Currentversion/Run'
but I still can't find it. Do you have any suggestions?

 

[Will Denny]

Hi

That is a reference to a value in the Registry. If you go to Start>Run and
then type

regedit

the Registry Editor will open. You will then have to navigate to that key
in the left hand column and then for a reference to the file in the right
hand column and delete it.

However **please* back up that part of the Registry first via File>Export.
Manually altering any value in the Registry can render your system
unbootable.

 

[Guest]

I did what you said, and deleted it that way, but it still remains. Do you
know how I could find it?

 

[Fitz]

I don't see where you have mentioned the name of the file. My news server
may have dropped it but what is the name of the file?

 

[Guest]

Oh sorry about that. It's called SurvivalProjecthack. The link was a patch
for this game and it turned out to be a hacking program. I don't want to use
it though.

 

[Fitz]

Navigate to C:\windows\prefetch. Delete all the files in the prefetch
folder. Don't delete the folder itself. Make sure the item has not been
added again in the msconfig startup group or in the run section of the
registry (SOFTWARE/Microsoft/Windows/Currentversion/Run). Turn off system
restore and reboot. If all is OK, re-enable system restore. If not, post
back.

 

[Guest]

How do I turn off system restore?

Navigate to C:\windows\prefetch. Delete all the files in the prefetch
folder. Don't delete the folder itself. Make sure the item has not been
added again in the msconfig startup group or in the run section of the
registry (SOFTWARE/Microsoft/Windows/Currentversion/Run). Turn off system
restore and reboot. If all is OK, re-enable system restore. If not, post
back.

 

[Fitz]

Right click My Computer>Select Properties>Select System Restore Tab. Check
Turn Off System Restore.

 

[Guest]

I did what you said and it's still there.

Right click My Computer>Select Properties>Select System Restore Tab. Check
Turn Off System Restore.

 

[Fitz]

After you turned off System Restore and before you rebooted, did you check
msconfig and make sure the file wasn't there? You said this was a patch
that turned out to be a hacking program. Did you mean it was a game hack or
a program that hackers use? What site did it come from? Do you still have
the game installed?

 

[zubzero]

Hi,
Download spywareBlaster.It helped me.
http://www.javacoolsoftware.com/spywareblaster.html

It is free to use.

 

[Guest]

No it's not there. This program is supposed to hack the game but I haven't
played it much, just in case it worked. The only way I know it's still there
is the game gives me a message that I'm running a hack or macro. I'm not sure
what site it came from. I had the game installed, removed it, then
reinstalled it.

 

[Fitz]

Alright...let's try this. I know you've done most of these tings before but
let's take them in order.

Disable System restore.
Download updated virus definitions for your AV program.
Download HijackThis (do a Google search) and see if anything suspicious is
listed. Be careful.
If you use Spybot, Spyare Guard, Adaware, or others, download latest
definitions.
If the hack is in MSCONFIG, note the path to the file then disable it in
MSCONFIG.
Follow the noted path and delete the file if found.
Uninstall the game.
Uninstall the hack (if present)
If the hack is in the registry,
(SOFTWARE/Microsoft/Windows/Currentversion/Run) delete it.
While in the registry, do a search for the file and if found, delete all
references to it.
Open Task Manager and see if the hack is running in the process list.
Navigate to the C:\Program files directory and delete the folder for the
game (if present).
Navigate to the C:\Program files and delete the folder for the hack (if
present).
Navigate to the C:\Windows\Prefetch and delete the contents (not the folder
itself).
Run a free online virus scan from somebody like
www.pandasoftware.com./acvtivescan.
Make notes of any suspicious things it finds but doesn't delete.
Find those things from Panda and manually delete them.

Restart in safe mode.

Run your antivirus. If stuff is found, clean it and run again until nothing
is found.
Run Adaware and etc. If stuff is found, clean it and run again until
nothing is found.
If the hack is still in MSCONFIG, note the path to the file then disable it
in MSCONFIG.
Follow the noted path and delete the file if found.
If the hack is in the registry,
(SOFTWARE/Microsoft/Windows/Currentversion/Run) delete it.
While in the registry, do a search for the file and if found, delete all
references to it.
Open Task Manager and see if the hack is running in the process list.
Navigate to the C:\Program files directory and delete the folder for the
game (if present).
Navigate to the C:\Program files and delete the folder for the hack (if
present).
Look for those things from Panda that weren't cleaned and manually delete
them (if present).

Restart computer. Your computer has something listed somewhere that is
calling this program to run when it starts. It may be in the registry,
startup items or just hidden someplace sneaky. Also, I'm not clear on
whether you are still getting the message on boot up or when you start the
game. Let us know how the above works for you.

 

[Guest]

Ok. I did all of that and it appeares to be gone. I can't truely see until a
few days. I used to have Norton Anti-Virus but someone in my family deleted
it. Thanks for all your help.